ModSecurity has a false positive trying to open the url: https://www.galgani.it/solitudine-contesti-virtuali-internet-facebook-social-network-smartphone/solitudine-e-contesti-virtuali.html
It returs a 403 error.
It's only a simple static html page without javascript or dynamic code.
ModSecurity works fine for my other pages. In the /etc/modsecurity/modsecurity.conf, which rule can I add to whitelist (or exclude) that specific url?
The error is:
[Fri Mar 27 14:54:50.189006 2020] [:error] [pid 10566:tid 140214542481152] [client 91.252.113.190:26752] [client 91.252.113.190] ModSecurity: Warning. Operator GE matched 4 at TX:outbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "82"] [id "980140"] [msg "Outbound Anomaly Score Exceeded (score 4): PHP source code leakage"] [tag "event-correlation"] [hostname "www.galgani.it"] [uri "/solitudine-contesti-virtuali-internet-facebook-social-network-smartphone/solitudine-e-contesti-virtuali.html"] [unique_id "Xn4FqfNLERK@02hvkdmOogAAAFI"]
Solved! The rule to be inserted in /etc/modsecurity/modsecurity.conf, to whitelist that specific URL, is:
SecRule REQUEST_FILENAME "@streq /solitudine-contesti-virtuali-internet-facebook-social-network-smartphone/solitudine-e-contesti-virtuali.html" "id:1,phase:2,nolog,allow,ctl:ruleEngine=Off"